CSC 322 Operating Systems Concepts Lecture - 30: b y Ahmed Mumtaz Mustehsan

1. CSC 322 Operating Systems Concepts Lecture - 30: by Ahmed Mumtaz Mustehsan Special Thanks To: Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. (Chapter-11) Operating Systems (Third Edition)Deitel, Deitel and ChoffnesPrentice Hall, 2004, (Chapter-21) Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

2. Case Study Windows VISTA Chapter 11 Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

3. Windows Vista • History • Programming Windows Vista • Operating System Structure • Process and Thread Management • Thread Scheduling • Memory Management • Input/Output in Vista • File System (NTFS ) • Security • Interprocess Communication Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

4. History of Microsoft OS Platforms Major releases in the history of Microsoft operatingsystems for desktop PCs. Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

5. History of Microsoft OS Platforms • 1976 Bill Gates and Paul Allen founded Microsoft • 1981 MS-DOS 1.0 (Known as CP/M) • 16-bit addressing • 8 KB memory resident code • 1985 Windows 1.0 • First Microsoft GUI operating system • 1990 Windows 3.1 and Windows for Workgroups 3.1 • Added network support (LANs) • 1992 Windows NT 3.1 • NTFS • 32-bit addressing • 1995 Windows 95 • 32-bit addressing • DirectX • Simulates direct access to hardware through API Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

6. History of Microsoft OS Platforms • 1996 Windows NT 4.0 • Moved graphics driver into kernel • 1998 Windows 98 • Bundled Internet Explorer into operating system • 2000 Windows ME • Does not boot in DOS mode • 2000 Windows 2000 • Active Directory • Database of users, computers and services • 2001 Windows XP • 64-bit support • 2006 Windows Vista Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

7. 2000s: NT-based Windows DEC Operating Systems developed by Dave Cutler • NT was inspired from VMS operating system • DEC (Digital Equipment Company), a minicomputer maker was sold in 1998 to Compaq which was bought by HP • NT was also jointly developed as OS/2 for IBM Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

8. 2000s: NT-based Windows • The Win32 API allows programs to run on almost all versions of Windows. Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

9. 2000s: NT-based Windows Split client and server releases of Windows. Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

10. Size of Code Windows Vista vs LINUX Comparison of lines of code for selected kernel-mode modules in Linux and Windows (from Mark Russinovich, co-author of Microsoft Windows Internals). Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

11. Programming Windows Vista The programming layers in Windows • Beneath the applets and GUI layers we have the API • These are dynamic link libraries (DLLs) • NTOS is the kernel mode program which provides the system call interface for Microsoft programmers (not open to public) Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

12. The Native NT Application Programming Interface Common categories of kernel-mode object types. Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

13. The Native NT Application Programming Interface (2) • Examples of native NT API calls that use handles to manipulate objects across process boundaries. Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

14. The Win32 Application; Programming Interface • Win32 API :Interface for developing applications • Fully documented and publicly disclosed • The API is a library of procedures that either wrap (use and call somehow) the native NT system calls or do the work themselves • Two special execution environments are also provided • WOW32 (Windows-on-Windows) which is used on 32-bit x86 systems to run 16-bit Windows 3.x applications by mapping system calls and parameters between the 16-bit and 32-bit worlds • WOW64 does the same thing for 32-bit applications to work on x64 systems • Previously there were OS2 and POSIX environments but not anymore Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

15. The Win32 Application : Programming Interface Examples of Win32 API calls and the native NT API calls that they wrap. Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

16. The Windows Registry The registry hives in Windows Vista. HKLM is a short-hand for HKEY_LOCAL_MACHINE. • Registry is a special file system to record the details of system configuration • The registry is organized into separate volumes called hives • When the system is booted the SYSTEM hive is loaded into memory Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

17. The Windows Registry (Win32 API Functions) Some of the Win32 API calls for using the registry • Before the registry, older Windows versions kept configuration information in .ini (initialization) files scattered all around the disk • Regedit is a program to inspect and modify the registry but be carefull Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

18. Operating System Structure Windows kernel-mode organization. Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

19. Operating System Kernel • The system library (ntdll.dll) executing at user-mode contains compiler run-time and low-level libraries • NTOS kernel layer: thread scheduling, synchronization abstractions, trap handlers, interrupts etc. • NTOS executive layer contains the services such as management services for virtual memory, cache, I/O etc. • HAL (Hardware Abstraction Layer) • Interacts with hardware, drives device components on mainboard • Abstracts hardware specifics the difference between systems of the same architecture (such as different CPUs) • Device drivers are used for any kernel-mode activities which are not a part of NTOS or HAL (such as file system, network protocols and antivirus software) Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

20. Booting Windows Vista • On power on, BIOS loads a small bootstrap loader found at the beginning of the disk drive partitions • Bootstrap loader loads BootMgr program from the root directory • If hibernated or in stand-by mode WinResume.exe is loaded else Winload.exe is loaded for a fresh boot. This programloads: • Ntoskrnl.exe • Hal.dll • SYSTEM hive • Win32k.sys (kernel-mode parts of Win32 subsystem) • Other boot drivers Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

21. Process and Thread Management • Processes (containers for threads. Process Environment BlockPEB) • Threads (Basic scheduling unit. Normally executes in user-mode. Thread Environment BlockTEB ) • Jobs • Group processes together as a unit • Manage resources consumed by these processes (e.g., CPU time, memory consumption, etc.) • Terminate all processes at once Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

22. Process and Thread Organization • Fibers • Unit of execution (like a thread) • Scheduled by thread that creates them, not microkernel. • Thread must convert itself into a fiber to create fibers • Advantage is in fast switching: Thread switching requires entry and exit to kernel. A fiber switch saves and restores a few registers withou changing modes at all • Used rarely Ahmed MumtazMustehsan, GM-IT, CIIT, Islamabad

23. Process and Thread Organization • Thread pools • Worker threads that sleep waiting for work items • Each process gets a thread pool • Useful in certain situations • Fulfilling client requests • Asynchronous I/O • Combining several threads that sleep most of the time • Memory overhead and less control for the programmer Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

24. Processes and Threads • The relationship between jobs, processes, threads and fibers. Jobs and fibers are optional; not all processes are in jobs or contain fibers. Basic concepts used for CPU and resource management. Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

25. Thread Synchronization Dispatcher objects • Event object • Signaled when event occurs; • unsignaled either when one thread awakens or all threads awaken (choice determined by event’s creator) • Mutex object • One owner • Acquire – unsignaled; release – signaled • Semaphore object • Counting semaphore • Signaled while count > 0; unsignaled when count 0 • Can be acquired multiple times by same thread Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

26. Thread Synchronization Dispatcher objects (cont.) • Waitable timer object • Signaled when time elapses • Manual reset vs. auto reset • Single user vs. periodic Examples: Objects that can act as dispatcher objects; Process, thread, console input Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

27. Thread Synchronization • Kernel mode locks • Spin lock • Queued spin lock • More efficient than spin lock • Guarantees FIFO ordering of requests • Fast mutex • Like a mutex, but more efficient • Cannot specify maximum wait time • Reacquisition by owning thread causes deadlock • Executive resource lock • One lock holder in exclusive mode • Many lock holders in shared mode • Good for readers and writers Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

28. Thread Synchronization skip • Other synchronization tools • Critical section object • Like a mutex, but only for threads of the same process • Faster than a mutex • No maximum wait time • Timer-queue timer • Waitable timer objects combined with a thread pool • Interlocked variable access • Atomic operations on variables • Interlocked singly-linked lists • Atomic insertion and deletion Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

29. Synchronization skip • Some of the Win32 calls for managing processes, threads, and fibers. Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

30. Thread Scheduling • Thread States • Initialized • Ready • Standby • Running • Waiting • Transition • Terminated • Unknown Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

31. Thread Scheduling • Windows kernel does not have a central scheduling thread. Instead, when a thread can not run any more, the thread enters kernel-mode and calls into the scheduler itself to see which thread to switch to Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

32. Thread Scheduling (3) • The following conditions cause the currently running thread to execute the scheduler code: • The currently running thread blocks on a semaphore, mutex, event, I/O, etc. • The thread signals an object (e.g., does an up on a semaphore or causes an event to be signaled). • The quantum expires. • The scheduler is also called under two otherconditions: • An I/O operation completes. • A timed wait expires. Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

33. Thread Scheduling Mapping of Win32 thread priorities to Windows Process class priorities. Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

34. Thread Scheduling (4)skip • Windows Vista supports 32 priorities for threads. • Round-robin for highest-priority non-empty ready queue Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

35. Memory Management • Virtual address space layout for three user processes on the x86. The white areas are private per process. The shaded areas are shared among all processes. • Explanation next slide Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

36. Memory Management(2) • Bottom and top 64 KB are intentionally unmapped • 64 KB – 2 GB: User’s private code and data • 2 GB – 4 GB (less 64 KB) : Operating system kernel virtual memory containing code, data, paged and nonpaged pools as well as process page table. • Kernel virtual memory is shared by all processes and is only accessible while running in kernel mode • For x86 and x64 systems virtual address space is demand paged with 4 KB sized pages (No segmentation) Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

37. Memory Management System Calls • The principal Win32 API functions for managing virtual memory in Windows. Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

38. Implementation of Memory Management • Mapped regions with their shadow pages on disk. The lib.dll file mapped into two address spaces at same time. Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

39. Page Fault Handling skip Figure 11-33. A page table entry (PTE) for a mapped page on the (a) Intel x86 and (b) AMD x64 architectures. • D and A bits are used to implement a LRU (Least Recently Used) style page replacement algorithm Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

40. Page Fault Handling (2) Each page fault can be considered as being in one of five categories: • The page referenced is not committed (program error – page has not been assigned to a process or in memory). • Attempted access to a page in violation of the permissions (program error). • A shared copy-on-write page was about to be modified. • The stack needs to grow. • The page referenced is committed but not currently mapped in (normal page fault in a paged system). Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

41. Page Replacement Algorithm (1) • The working set concept is used • Each process (not each thread) has a working set • Each working set has two parameters: • A minimum size (initally 20 to 50 pages) • A maximum size (initially 45 to 345 pages) • Every process starts with the same minimum and maximum but these bounds can change over time Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

42. Page Replacement Algorithm (2) • Working sets only come into play when physical memory gets low • Otherwise, processes can exceed the maximum of their working set • The working set manager runs periodically based on a timer and does the following: • When lotof memory is available, it uses the access bits to compute an age for each page • When memory gets tight, the working set is fixed and oldest pages are replaced when a new page is needed • When memory is tight, the working sets are trimmed below their maximum by removing the oldest pages Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

43. Physical Memory Manager (1) • The various page lists and the transitions between them. Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

44. Physical Memory Manager (2) • Pages removed from a working set are put on either modified page list or standby page list (pages which are not modified) • The pages on these two lists are in memory so if a page fault occurs and one of these pages is needed, they are put back to the working set with no disk I/O (A soft page fault) • When a process exits all nonshared pages of the working set, modified pages and standby pages are returned to the free page list Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

45. Physical Memory Manager (3) • A modified page writer thread wakes up periodically and writes modified pages to disk and move them to the standby list if there are not enough clean pages • When a page is not needed by a process, it goes to the free page list • At a page fault (hard fault) a free page is taken from the free page list • Whenever the CPU is idle, a lowest priority thread, the ZeroPage thread resets free pages to zeros and puts them on zeroed page list • When a zeroed page is needed for security reasons, pages are taken from the zeroed page list Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

46. Input/Output in Vista • The I/O system consists of • Plug-and-play services • The power manager • The Input/Output manager • Device drivers Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

47. Plug-and-Play Services • Buses such as PCI, USB, EIDE, and SATA had been designed in such a way that the plug-and-play manager can send a request to each slot and ask the device there to identify itself • After identification PnP manager allocates hardware resources, such as interrupt levels, locates the appropriate drivers, and loads them into memory • As each driver is loaded, a driver object is created Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

48. Power Manager • The power manager adjusts the power state of the I/O devices to reduce system power consumption when devices are not in use • This is very important when laptops are on battery power • Two special modes of power saving: • Hibernation mode: all of the physical memory is copied to disk and power consumption is reduced to a minimum level • Standby mode: power is reduced to the lowest level enough to refresh the dynamic RAM Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

49. Input/Output Manager • Handles I/O system calls and IRP (I/O Request Packet) based operations Native NT API calls for performing I/O Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad

50. Device Drivers • All drivers must conform to the WDM (Windows Driver Model) standarts for compatibility reasons with the older windows versions • Devices in Windows are represented by device objects which are used to represent • Hardware, such as buses • Software abstractions like file systems, network protocol engines and kernel extensions, like antivirus filter drivers Ahmed Mumtaz Mustehsan, GM-IT, CIIT, Islamabad